• <ins id="pjuwb"></ins>
    <blockquote id="pjuwb"><pre id="pjuwb"></pre></blockquote>
    <noscript id="pjuwb"></noscript>
          <sup id="pjuwb"><pre id="pjuwb"></pre></sup>
            <dd id="pjuwb"></dd>
            <abbr id="pjuwb"></abbr>

            tqsheng

            go.....
            隨筆 - 366, 文章 - 18, 評(píng)論 - 101, 引用 - 0
            數(shù)據(jù)加載中……

            鍵盤(pán)鉤子比較麻煩的就是得到KeyboardInterruptService 的地址,有什么方法呢

            得到i8042prt!I8042KeyboardInterruptService 地址的好方法
            http://www.cnblogs.com/adward/archive/2009/04/27/1444921.html



            鍵盤(pán)鉤子比較麻煩的就是得到KeyboardInterruptService 的地址,有什么方法呢?lkd> !idt

            Dumping IDT:

            37: 806d0728 hal!PicSpuriousService37
            3d: 806d1b70 hal!HalpApcInterrupt
            41: 806d19cc hal!HalpDispatchInterrupt
            50: 806d0800 hal!HalpApicRebootService
            62: 84d587ec atapi!IdePortInterrupt (KINTERRUPT 84d587b0)
            63: 84cebdd4 USBPORT!USBPORT_InterruptService (KINTERRUPT 84cebd98)
                      USBPORT!USBPORT_InterruptService (KINTERRUPT 84ce4988)
                      USBPORT!USBPORT_InterruptService (KINTERRUPT 84cddb78)
                      USBPORT!USBPORT_InterruptService (KINTERRUPT 84cd6d10)
                      USBPORT!USBPORT_InterruptService (KINTERRUPT 84ccfd98)
            73: 84d08044 VIDEOPRT!pVideoPortInterrupt (KINTERRUPT 84d08008)
            82: 84d58044 atapi!IdePortInterrupt (KINTERRUPT 84d58008)
            83: 84dbf67c atapi!IdePortInterrupt (KINTERRUPT 84dbf640)
                      atapi!IdePortInterrupt (KINTERRUPT 84dbf3d0)
            92: 84c0a044 serial!SerialCIsrSw (KINTERRUPT 84c0a008)
            93: 84c0bdd4 i8042prt!I8042KeyboardInterruptService (KINTERRUPT 84c0bd98)
            a3: 84c0b044 i8042prt!I8042MouseInterruptService (KINTERRUPT 84c0b008)

            lkd> dt _KINTERRUPT 84c0bd98
            nt!_KINTERRUPT
               +0x000 Type             : 22
               +0x002 Size             : 484
               +0x004 InterruptListEntry : _LIST_ENTRY [ 0x84c0bd9c - 0x84c0bd9c ]
               +0x00c ServiceRoutine   : 0xf76cc495 /*就是這兒了*/    unsigned char i8042prt!I8042KeyboardInterruptService+0
               +0x010 ServiceContext   : 0x84d5da88
               +0x014 SpinLock         : 0
               +0x018 TickCount        : 0xffffffff
               +0x01c ActualLock       : 0x84d5db48 -> 0
               +0x020 DispatchAddress : 0x80541aa0     void nt!KiInterruptDispatch+0
               +0x024 Vector           : 0x193
               +0x028 Irql             : 0x8 ''
               +0x029 SynchronizeIrql : 0x9 ''
               +0x02a FloatingSave     : 0 ''
               +0x02b Connected        : 0x1 ''
               +0x02c Number           : 0 ''
               +0x02d ShareVector      : 0 ''
               +0x030 Mode             : 1 ( Latched )
               +0x034 ServiceCount     : 0
               +0x038 DispatchCount    : 0xffffffff
               +0x03c DispatchCode     : [106] 0x56535554

            當(dāng)然還可以特征碼搜索啦!也麻煩!

            rootkit上那個(gè)鍵盤(pán)王子介紹了一種很妙的方法!上代碼。

            PKINTERRUPT GetI8042PrtInterruptObject(void)
            {
            PDEVICE_OBJECT pDeviceObject = NULL; // Keyboard DeviceObject
            PFILE_OBJECT   fileObject;
            UNICODE_STRING keyName;
            // PPORT_KEYBOARD_EXTENSION KeyboardExtension;
            PKINTERRUPT ReturnValue = NULL;
              
            RtlInitUnicodeString( &keyName, NT_KEYBOARD_NAME0 );

            // Getting the DeviceObject top-of-the-stack of the kbdclass device
            IoGetDeviceObjectPointer(&keyName,
                     FILE_READ_ATTRIBUTES,
                     &fileObject,
                     &pDeviceObject);

            // if fails
            if( !pDeviceObject )
            {
               return NULL;
            }

            // Tracking the DeviceStack
            //
            //
            // If it is not a i8042prt
            while( pDeviceObject->DeviceType != FILE_DEVICE_8042_PORT )//下一個(gè)就是了,0x27
            {
               // go to the lower level object
               if (((PR_DEVOBJ_EXTENSION)pDeviceObject->DeviceObjectExtension)->AttachedTo)
                pDeviceObject = ((PR_DEVOBJ_EXTENSION)pDeviceObject->DeviceObjectExtension)->AttachedTo;
               else // here is lowest-level and couldn't find i8042prt
                  return NULL;
            }
            //
            // pDeviceObject == i8042prt's DeviceObject
            //
            ReturnValue = (PKINTERRUPT)((PPORT_KEYBOARD_EXTENSION)pDeviceObject->DeviceExtension)->InterruptObject;

            return ReturnValue;
            }

            主函數(shù)中調(diào)用

               ADDR= (ULONG)GetI8042PrtInterruptObject( );
                dprintf("keyboatserv.SYS: 0X%08X\n", ADDR);
            // +0x00c ServiceRoutine   : 0xf76cc495     unsigned char i8042prt!I8042KeyboardInterruptService+0
            // 找到了函數(shù)的地址了;
            I8042KeyboardInterruptServiceADDR=(ULONG)((PKINTERRUPT)GetI8042PrtInterruptObject()->ServiceRoutine);
            dprintf("keyboatserv.SYS: 0X%08X\n", I8042KeyboardInterruptServiceADDR);

            要用的結(jié)構(gòu)

            typedef struct _R_DEVOBJ_EXTENSION
            {
            CSHORT Type;
            USHORT Size;
            PDEVICE_OBJECT DeviceObject;
            ULONG   PowerFlags;
            PVOID Dope;
            ULONG ExtensionFlags;
            PVOID DeviceNode;
            PDEVICE_OBJECT AttachedTo;
            ULONG StartIoCount;
            ULONG StartIoKey;
            ULONG StartIoFlags;
            PVOID Vpb;
            } R_DEVOBJ_EXTENSION, *PR_DEVOBJ_EXTENSION;

            typedef struct _PORT_KEYBOARD_EXTENSION {
                // Pointer back to the this extension's device object.
                PDEVICE_OBJECT      Self;
                PKINTERRUPT    InterruptObject;
            } PORT_KEYBOARD_EXTENSION, *PPORT_KEYBOARD_EXTENSION;
            typedef struct _KINTERRUPT {
                CSHORT   Type;
                CSHORT      Size;
                LIST_ENTRY          InterruptListEntry;
                ULONG               ServiceRoutine;
                ULONG               ServiceContext;
                KSPIN_LOCK          SpinLock;
                ULONG               TickCount;
                PKSPIN_LOCK         ActualLock;
                PVOID               DispatchAddress;
                ULONG         Vector;
                KIRQL               Irql;
                KIRQL               SynchronizeIrql;
                BOOLEAN             FloatingSave;
                BOOLEAN             Connected;
                CHAR                Number;
                UCHAR                ShareVector;
                KINTERRUPT_MODE     Mode;
                ULONG               ServiceCount;
                ULONG               DispatchCount;
                ULONG               DispatchCode[106];
            } KINTERRUPT, *PKINTERRUPT;

            有了函數(shù)地址大家就自己發(fā)揮了啊!什么模擬按鍵,讀取端口。

            還可以接著找鼠標(biāo)的函數(shù)了,那就方便了啊

            posted on 2009-06-18 13:59 tqsheng 閱讀(299) 評(píng)論(0)  編輯 收藏 引用


            只有注冊(cè)用戶登錄后才能發(fā)表評(píng)論。
            網(wǎng)站導(dǎo)航: 博客園   IT新聞   BlogJava   博問(wèn)   Chat2DB   管理


            国产精品视频久久久| 亚洲日韩中文无码久久| 久久综合给合久久狠狠狠97色 | 国产色综合久久无码有码| 999久久久免费精品国产| 亚洲日韩欧美一区久久久久我 | 99久久国产综合精品网成人影院 | 国产福利电影一区二区三区久久久久成人精品综合 | 久久狠狠爱亚洲综合影院 | 久久婷婷午色综合夜啪| 日日躁夜夜躁狠狠久久AV| 久久久久久精品成人免费图片| 久久九九久精品国产免费直播| 精品久久久无码21p发布| 婷婷久久综合| 国产成人精品久久免费动漫| 久久亚洲AV成人无码国产| 久久国产精品99国产精| 久久综合九色综合久99| 久久综合给合久久国产免费| 久久久亚洲欧洲日产国码aⅴ| 99久久久精品| 久久成人精品| 精品一区二区久久久久久久网站| 婷婷久久五月天| 亚洲综合伊人久久综合| 久久99久久99小草精品免视看| 精品免费久久久久国产一区 | 大香伊人久久精品一区二区| 99久久国产综合精品五月天喷水| 精品久久久久久无码中文野结衣| 伊人久久大香线蕉AV一区二区| 蜜臀av性久久久久蜜臀aⅴ| 99久久国产综合精品成人影院 | 亚洲精品国产第一综合99久久| 狠狠色丁香婷婷久久综合| 99国产欧美久久久精品蜜芽| 手机看片久久高清国产日韩| 97精品久久天干天天天按摩 | 久久精品国产男包| 国产亚洲婷婷香蕉久久精品|